chore: R-16 toolchain pin + reconciliation #52
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -12,5 +12,5 @@ permissions: | |
| contents: read | ||
| jobs: | ||
| mirror: | ||
| uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 | ||
|
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- repository guidance ---'
head -5 /tmp/coderabbit-repo-knowledge/hyperpolymath-cicd-squabbler-2bf3e722/*/*.md 2>/dev/null || true
printf '%s\n' '--- workflow files ---'
cat -n .github/workflows/mirror.yml
cat -n .github/workflows/rust-ci.yml
printf '%s\n' '--- relevant references and repository metadata ---'
rg -n -C 2 'mirror-reusable|rust-ci-reusable|5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236|standards' .github README.md 2>/dev/null || true
git remote -v 2>/dev/null || trueRepository: hyperpolymath/cicd-squabbler Length of output: 8420 🌐 Web query:
💡 Result: The GitHub repository hyperpolymath/standards acts as the central hub for the organization's reusable GitHub Actions workflows, designed to eliminate configuration drift across its software estate [1][2][3]. The workflow files and the specific SHA you inquired about are defined as follows: - mirror-reusable.yml: This workflow automates the mirroring of repositories to multiple git forges (e.g., GitLab, Bitbucket, Codeberg) [1][2]. Repositories typically implement it by calling the reusable workflow in a local.github/workflows/mirror.yml file [4]. - rust-ci-reusable.yml: This workflow provides a standardized CI pipeline for Rust projects, encompassing check, test, audit, and coverage jobs [5]. It is commonly invoked via a thin wrapper in repository.github/workflows/rust-ci.yml files [3]. - SHA 5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236: This specific commit hash is associated with the hyperpolymath/standards repository [6][4]. It is explicitly documented as the pinned version for the changelog-reusable.yml workflow [6] and has been utilized in the organization's mirror-reusable.yml deployments [4]. In mid-2026, the organization underwent a significant "estate-wide convergence" campaign, replacing local, drift-prone workflow files with these reusable wrappers to centralize maintenance [1][2]. During this period, the organization experienced CI breakages (e.g., due to mandatory toolchain input changes in the underlying rust-ci-reusable.yml), necessitating widespread re-pinning of these SHAs across the organization's repositories [5][7][8]. Citations:
🏁 Script executed: #!/bin/bash
set -u
sha='5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236'
repo='hyperpolymath/standards'
api="https://api.github.com/repos/${repo}"
printf '%s\n' '--- reference length and format ---'
python3 - <<'PY'
sha = '5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236'
print(f'length={len(sha)} hexadecimal={all(c in "0123456789abcdef" for c in sha)}')
PY
printf '%s\n' '--- commit resolution ---'
curl -sS -L -H 'Accept: application/vnd.github+json' \
"$api/commits/$sha" | jq '{status: (if .sha then "resolved" else "error" end), sha: .sha, message: .commit.message, html_url, api_message: .message}'
for path in \
'.github/workflows/mirror-reusable.yml' \
'.github/workflows/rust-ci-reusable.yml'
do
printf '%s\n' "--- contents at $path@$sha ---"
curl -sS -L -H 'Accept: application/vnd.github+json' \
--get "$api/contents/$path" --data-urlencode "ref=$sha" |
jq '{type, name, path, sha, api_message: .message}'
doneRepository: hyperpolymath/cicd-squabbler Length of output: 928 Replace the unresolved reusable-workflow ref in both files.
🧰 Tools🪛 zizmor (1.29.0)[warning] 15-15: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow (secrets-inherit) 📍 Affects 2 files
🤖 Prompt for AI AgentsSource: MCP tools |
||
| secrets: inherit | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,4 @@ | ||
| K9! | ||
|
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
command -v nickel >/dev/null
probe="$(mktemp --suffix=.ncl)"
trap 'rm -f "$probe"' EXIT
printf 'K9!\n{}\n' > "$probe"
if nickel typecheck "$probe"; then
echo "Unexpected: Nickel accepted the raw K9! sentinel" >&2
exit 1
fiRepository: hyperpolymath/cicd-squabbler Length of output: 166 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- repository conventions ---'
find /tmp/coderabbit-repo-knowledge/hyperpolymath-cicd-squabbler-2bf3e722 -maxdepth 2 -type f -name '*.md' -print \
| sort \
| while IFS= read -r f; do
printf '\n### %s\n' "$f"
head -80 "$f"
done
printf '%s\n' '--- changed files ---'
for f in \
.machine_readable/contractiles/dust/dust.k9.ncl \
.machine_readable/contractiles/intend/intend.k9.ncl \
.machine_readable/contractiles/must/must.k9.ncl \
.machine_readable/contractiles/trust/trust.k9.ncl \
.machine_readable/self-validating/methodology-guard.k9.ncl \
container/stapeln/deploy.k9.ncl
do
printf '\n### %s\n' "$f"
if [ -f "$f" ]; then
cat -n "$f"
else
printf 'MISSING\n'
fi
done
printf '%s\n' '--- K9 references and Nickel parsing paths ---'
rg -n -S --hidden --glob '!/.git' \
'K9!?|k9|nickel|typecheck|eval|parse' \
.machine_readable container .github scripts Makefile justfile Taskfile.yml 2>/dev/null \
| head -300 || trueRepository: hyperpolymath/cicd-squabbler Length of output: 50384 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- K9 references ---'
rg -n -S --hidden --glob '!/.git' --glob '!*.k9.ncl' \
'K9!?|\.k9\.ncl|k9' . \
| head -250 || true
printf '%s\n' '--- Nickel references ---'
rg -n -S --hidden --glob '!/.git' \
'nickel|typecheck|eval|parse' . \
| head -250 || true
printf '%s\n' '--- relevant file names ---'
git ls-files | rg -i '(^|/)(k9|nickel|contractile|loader|validator|verify|README|Makefile|justfile|Taskfile)' \
| head -250Repository: hyperpolymath/cicd-squabbler Length of output: 50384 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- validator contract ---'
sed -n '1,155p' .githooks/validate-k9.sh
printf '%s\n' '--- CI invocation ---'
sed -n '60,100p' .github/workflows/dogfood-gate.yml
printf '%s\n' '--- direct Nickel usage ---'
sed -n '80,110p' .machine_readable/self-validating/README.adoc
sed -n '170,187p' container/README.adoc
printf '%s\n' '--- remaining affected file headers ---'
for f in .machine_readable/self-validating/methodology-guard.k9.ncl container/stapeln/deploy.k9.ncl; do
printf '\n### %s\n' "$f"
sed -n '1,35p' "$f"
doneRepository: hyperpolymath/cicd-squabbler Length of output: 11246 🌐 Web query:
💡 Result: No, an exclamation mark (!) is not a valid character for identifiers in the Nickel language [1]. According to the official Nickel documentation, identifiers must follow a specific syntax: they must start with zero or more underscores (), followed by an alphabetic character (a-z or A-Z), and may then contain zero or more alphanumeric characters, underscores (), dashes (-), or single quotes (') [1]. The exclamation mark (!) is recognized by the Nickel lexer as a distinct symbolic token (often associated with negation or other operators) rather than a constituent part of an identifier name [2]. Furthermore, internal Nickel language compiler documentation notes that characters such as the percentage sign (%)—often used for generating fresh identifiers—are chosen specifically because they are syntactically impossible to include in standard Nickel program identifiers, preventing name collisions [3][4]. Citations:
Strip All six files require the raw 📍 Affects 6 files
🤖 Prompt for AI AgentsSource: MCP tools |
||
| # SPDX-License-Identifier: MPL-2.0 | ||
| # dust.k9.ncl — K9 trust-tier component of the dust trident | ||
| # Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| [tools] | ||
| # = "Uncomment and customize for your project" | ||
| # = "rust nightly" | ||
| # = "just 1.40.0" | ||
| # = "nickel 1.10.0" | ||
| # = "gleam 1.8.0" | ||
| # = "elixir 1.18.0" | ||
| # = "erlang 27.2" | ||
| # = "zig 0.14.0" | ||
| # = "idris2 0.7.0" | ||
| rust = "nightly" | ||
|
Comment on lines
+1
to
+11
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Resolve the root-shape check failure. The pipeline reports that the new root-level 🧰 Tools🪛 GitHub Actions: Estate Rules / 0_estate-rules.txt[error] 1-1: Root-shape check failed: entry is not on the allowlist. Move it into an appropriate subdirectory or add a justified entry to .machine_readable/root-allow.txt. 🪛 GitHub Actions: Estate Rules / estate-rules[error] 1-1: Root shape check failed: entry is not on the allowlist. Move it to an appropriate subdirectory or add a justified entry to .machine_readable/root-allow.txt. 🤖 Prompt for AI AgentsSource: Pipeline failures
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: printf '%s\n' '--- repository guidance index ---'
find /tmp/coderabbit-repo-knowledge/hyperpolymath-cicd-squabbler-2bf3e722 -maxdepth 2 -type f -name '*.md' -print
printf '%s\n' '--- relevant tracked files ---'
git ls-files .mise.toml .envrc .tool-versions '.machine_readable/scripts/lifecycle/install-tools.sh' README.md
printf '%s\n' '--- .mise.toml ---'
cat -n .mise.toml
printf '%s\n' '--- .envrc ---'
cat -n .envrc
printf '%s\n' '--- .tool-versions ---'
cat -n .tool-versions
printf '%s\n' '--- install-tools.sh ---'
cat -n .machine_readable/scripts/lifecycle/install-tools.sh
printf '%s\n' '--- relevant guidance headers ---'
head -5 /tmp/coderabbit-repo-knowledge/hyperpolymath-cicd-squabbler-2bf3e722/*/*.md 2>/dev/nullRepository: hyperpolymath/cicd-squabbler Length of output: 4262 Update the existing bootstrap paths for the mise pin.
🤖 Prompt for AI Agents |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,4 @@ | ||
| K9! | ||
| # SPDX-License-Identifier: MPL-2.0 | ||
| # deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) | ||
| # | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
Removing
actions: readviolates the requirement that the caller's permissions must be a superset of the called workflow's permissions. The reusable workflow requiresactions: read, so removing it will cause the workflow to fail at startup.